Add basic rate limiting to authentication endpoints

[ArchILLtect]

• Implement naive in-memory rate limiting (e.g., 5 attempts per 5 min per email/IP).
• Return 429 RATE_LIMITED error code when exceeded.
• Add INFO log for rate-limit triggers.
• Add unit/integration tests for rate limit logic.